payload-auth-plugin-fix
Version:
Authentication plugin for Payload CMS
47 lines (46 loc) • 2.1 kB
JavaScript
// src/core/protocols/oauth/oidc_callback.ts
import { parseCookies } from "payload";
import * as oauth from "oauth4webapi";
import { getCallbackURL } from "../../utils/cb.js";
import { MissingOrInvalidSession } from "../../errors/consoleErrors.js";
async function OIDCCallback(request, providerConfig, session_callback) {
const parsedCookies = parseCookies(request.headers);
const code_verifier = parsedCookies.get("__session-code-verifier");
const nonce = parsedCookies.get("__session-oauth-nonce");
if (!code_verifier) {
throw new MissingOrInvalidSession;
}
const state = request.query.state;
const [redirect_action, redirect_context] = state.split("--");
console.log(redirect_action, redirect_context);
const { client_id, client_secret, issuer, algorithm, profile } = providerConfig;
const client = {
client_id
};
const clientAuth = oauth.ClientSecretPost(client_secret ?? "");
const current_url = new URL(request.url);
current_url.searchParams.delete("state");
const callback_url = getCallbackURL(request.payload.config.serverURL, "admin", providerConfig.id);
const issuer_url = new URL(issuer);
const as = await oauth.discoveryRequest(issuer_url, { algorithm }).then((response2) => oauth.processDiscoveryResponse(issuer_url, response2));
const params = oauth.validateAuthResponse(as, client, current_url);
const response = await oauth.authorizationCodeGrantRequest(as, client, clientAuth, params, callback_url.toString(), code_verifier);
const token_result = await oauth.processAuthorizationCodeResponse(as, client, response, {
expectedNonce: nonce,
requireIdToken: true
});
const claims = oauth.getValidatedIdTokenClaims(token_result);
const userInfoResponse = await oauth.userInfoRequest(as, client, token_result.access_token);
const result = await oauth.processUserInfoResponse(as, client, claims.sub, userInfoResponse);
return session_callback(profile({
sub: result.sub,
name: result.name,
email: result.email,
picture: result.picture,
redirect_action,
redirect_context
}));
}
export {
OIDCCallback
};